Get a weekly CISA KEV digest with n8n (free workflow)

Description and use

An n8n workflow that runs every Monday to email a weekly digest of new CISA KEV entries, highlighting watchlist vendors.

Problem

Teams need a timely digest of newly exploited vulnerabilities to prioritize patching.

Outcome

The workflow reliably sends a weekly digest of new KEV entries, highlighting watchlist vendors and including due dates and remediation actions.

Workflow

• Schedule trigger every Monday 08:00
• Set live run flag via Code node
• Manual trigger sets dry‑run flag via Code node
• Download KEV feed with HTTP Request
• Filter entries added in the previous week and mark watchlist hits
• If dry run: log only; else: send email via SMTP with HTML table

Evidence

CISA publishes it as a public JSON feed with no API key, which makes it a good fit for a small n8n workflow.

Source

The workflow runs every Monday, keeps the entries added in the previous week (Mon‑Sun), stars the vendors you actually run, and emails your team an HTML digest.

Source

Three details matter: Compare date strings, not timestamps.

Source